Two-stage DDoS attack detection method based on software defined network
By adopting two-level detection methods of information entropy and deep learning in DDoS attack detection, the problems of low accuracy and inefficiency in the prior art are solved, and fast and accurate DDoS attack detection and protection are achieved.
Patent Information
- Application Number
- CN202411859162.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-17
- Publication Date
- 2025-04-04
AI Technical Summary
The existing DDoS attack detection technology has problems with low accuracy and inefficiency. The traditional method has too coarse or too fine granularity, making it difficult to effectively identify attack traffic. The classification time of machine learning models is long, so it is impossible to intercept attacks in time.
A two-level detection method based on information entropy and deep learning is adopted. First, coarse-grained detection is performed through the information entropy detection mechanism, suspicious devices and ports are screened out, and then fine-grained packet detection is used to distinguish between normal traffic and suspicious traffic.
It realizes rapid detection and high accuracy, saves system resources, improves detection efficiency and accuracy, and can promptly identify and intercept DDoS attacks.
Smart Images
Figure CN119766514A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of network security protection, and in particular relates to a method for rapid detection of two-stage DDoS attacks based on software defined networks. Background Art
[0002] With the rapid development of the Internet, the shortcomings of traditional networks have gradually been discovered. Emerging problems can only be solved by patching the network, which makes the network more bloated and less controllable. In order to get rid of this dilemma from the root, software defined network (SDN) came into being. SDN is a new network architecture that manages the network through software. The SDN architecture enables administrators to configure their networks using software applications.
[0003] Technically, SDN decouples the control plane from the data plane and solves the difficulty of deploying new services. The control plane is the networking process that directs network traffic, while the data plane is the actual data that traverses the network. The control plane is closely connected to the data plane and the underlying network hardware. When using SDN, the control plane is separated from the data plane and the actual hardware, allowing the control plane to be configured from a central controller.
[0004] Although SDN can enhance the controllability and flexibility of the network, it may also introduce new security issues. In SDN, the centralized nature of the controller makes it a prime target for attackers to launch distributed denial of service (DDoS) attacks. After receiving a data packet, the switch will send a Packet_In message to the controller to request the controller to process it. At this time, the controller will reply with a flow rule and store it in the switch's flow table. Based on this process, attackers can send a large number of data packets with forged source IP addresses, which cannot match any flow entry in the switch. Processing these forged data packets will occupy too much computing and memory resources of the controller, causing it to be unable to process legitimate requests from normal users.
[0005] Traditional DDoS attack detection technologies are based on empiricism, statistical analysis, or machine learning. However, those methods that only use empiricism or statistical analysis mostly show low accuracy. The core reason is that the granularity of their detection methods is too coarse. If the threshold range of normal traffic is set too large, some attack traffic may not be identified, but if it is set too small, normal traffic may be intercepted. For detection technologies using machine learning, accuracy is a major advantage, but they often show inefficiency because the model's classification time for the input features is generally longer than the controller's response time, which may result in the attack traffic not being intercepted in time. Summary of the invention
[0006] In view of the shortcomings of existing DDoS detection technology, the present invention designs and implements a two-level DDoS attack detection method based on software defined network.
[0007] The present invention adopts a two-level detection method based on information entropy and deep learning. First, the information entropy detection mechanism detects suspicious devices and ports at a coarse granularity. Then, the Convolutional Neural Network (CNN) model performs a fine-grained packet-based detection mechanism to distinguish normal traffic from suspicious traffic.
[0008] The two-stage DDoS attack detection method based on software defined network includes the following steps:
[0009] Step 1, load the network traffic data set and divide the data into windows;
[0010] Step 2, calculate the four feature entropies in each window, and calculate the mean and variance of these feature entropies;
[0011] Step 3, according to the mean and variance of feature entropy, four feature entropy thresholds are obtained through hypothesis testing;
[0012] Step 4, divide the window set into training set and test set;
[0013] Step 5, train and test the CNN model through the training set and test set;
[0014] Step 6, allocate a window of size n to each switch in the application;
[0015] Step 7, monitor each window and detect the rate at which the window is filled. If normal, continue to monitor the window; if abnormal, jump to step 8;
[0016] Step 8, calculate the four feature entropies in the abnormal window, and compare the four feature entropies with the threshold of the feature entropy. If it does not exceed the threshold, continue to monitor the window; if it exceeds the threshold, jump to step 9;
[0017] Step 9: Input the abnormal window into the trained CNN model. If the CNN model determines that it is a normal flow, continue to monitor the window; if it is an attack flow, send an alarm to the controller.
[0018] In step 1, the data in the network traffic data set is divided into two different window sizes. One is to divide the window in units of n; the other is to calculate according to the approximate distribution of the record packet length and divide the window according to the calculated packet length.
[0019] In step 2, Shannon entropy is calculated for the two windows in step 1. The window with n as the unit is used to calculate the source IP entropy srcIPEntropy, the destination IP entropy destIPEntropy, and the protocol entropy protocolEntropy; the window divided by packet length is used to calculate the packet length entropy pktLengthEntropy.
[0020] In step 3, the mean μ and variance σ of the four feature entropies are calculated respectively. 2 , the confidence intervals of each feature are calculated, and the source IP entropy threshold srcIPThreshold, the destination IP entropy threshold destIPThreshold, the protocol entropy threshold protocolThreshold, and the packet length entropy threshold pktLengthThreshold are determined by these confidence intervals.
[0021] In step 4, the window set divided in units of n in step 1 is divided into a training set and a test set.
[0022] In step 5, the flow-feature matrix (row vector represents flow and column vector represents feature) of size n×m corresponding to each window is input into the CNN model for training.
[0023] In step 6, a window (array) of size n is allocated to each switch device in the application to record the flows received by the device.
[0024] In step 7, the main monitoring content is the rate at which the packet-in information received by the controller fills the window. If the rate at which a window is filled does not exceed the threshold filledRateThreshold, the window is cleared and the window continues to be monitored; if the rate at which the window is filled exceeds the threshold filledRateThreshold, the switch records the source IP, destination IP, packet length, protocol and other information in the window, and jumps to step 8.
[0025] In step 8, the information recorded by monitoring each window in step 7 is used to calculate the real-time source IP entropy currentsteprcIPEntropy, the real-time destination IP entropy currentDestIPEntropy, the real-time protocol entropy currentProtocolEntropy and the real-time packet length entropy currentPktLengthEntropy, and compare them with the source IP entropy threshold srcIPThreshold, the destination IP entropy threshold destIPThreshold, the protocol entropy threshold protocolThreshold and the packet length entropy threshold pktLengthThreshold respectively. If the threshold is not exceeded, the window is cleared and the window is continued to be monitored; if the threshold is exceeded, jump to step 9.
[0026] In step 9, the window information recorded in step 7 is input into the model trained in step 7. The model finally determines whether there is an attack flow in the current window. If the model output is normal, the window is cleared and the window continues to be monitored. If the model output is abnormal, it can be determined that the current network is under attack and an alarm is sent to the controller.
[0027] The advantages of the present invention are:
[0028] By taking advantage of the resource-saving and fast detection of entropy detection, large-scale switch devices in the network can be screened at high speed, getting rid of the dilemma of conventional machine learning detection technology that requires a detection service for each device; at the same time, by taking advantage of the high accuracy of machine learning detection, the problem of coarse-grained detection in traditional analysis methods is avoided. In addition, the powerful ability of CNN to process matrices enables the model to process multiple flows at a time, greatly improving the detection efficiency compared with traditional classifiers.
[0029] The secondary detection technology reduces unnecessary resource consumption of the system while improving the speed and accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 is a system architecture diagram of the present invention;
[0031] Figure 2 It is an execution flow chart of the present invention;
[0032] Figure 3 This is a comparison chart of the CPU usage of the present invention and other detection technologies over time;
[0033] Figure 4 This is a comparison chart of the detection time of the present invention and other detection technologies. DETAILED DESCRIPTION
[0034] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation steps.
[0035] A two-level DDoS attack detection method based on software-defined networking, such as Figure 1 The system architecture diagram shown in the figure mainly consists of four parts, namely, a network cluster composed of interactive machines and hosts, a server composed of ONOS controllers and various ONOS applications, a server for training CNN models, and a flow detection server containing CNN models.
[0036] The specific process of the present invention is as follows Figure 2 As shown, the specific steps are as follows:
[0037] Step 1: Prepare data. The present invention uses the public data set InSDN, which contains a large number of features of normal traffic and attack traffic. The present invention uses different features in different detection stages. In entropy detection, the four-tuple tupleA = (source IP, destination IP, protocol, packet length) is used; in CNN detection, the eleven-tuple tupleB = (protocol, flow duration, total number of packets in the forward flow, total number of packets in the backward flow, total size of forward flow data packets, total size of backward flow data packets, average number of bytes in the flow, average number of packets in the flow, average number of forward data packets, average number of backward data packets, average data packet length).
[0038] Step 2: Window division. The present invention needs to divide the data into two windows of different sizes, one with size n, which is used to calculate the source IP entropy srcIPEntropy, the destination IP entropy destIPEntropy, the protocol entropy protocolEntropy and the training of the CNN model; the other division method is to calculate the packet length entropy pktLengthEntropy and divide according to the packet length.
[0039] By using the fitter module in Python to fit the distribution of packet lengths recorded in the data set, we can obtain an exponential distribution curve that approximately satisfies the parameter λ. This parameter λ is the increment of each group of packet lengths, that is,
[0040] Group(i)∈[x min +(i-1)λ,x min +iλ)
[0041] Group(i) represents the i-th group, where x min is the minimum packet length in the data set, which means that the packet length is in [x min +(i-1)λ,x min +iλ) are all classified into the i-th group.
[0042] Step 3: Calculate the source IP entropy srcIPEntropy, destination IP entropy destIPEntropy, protocol entropy protocolEntropy and packet length entropy pktLengthEntropy of normal traffic and attack traffic respectively. The calculation method is the same. Taking the source IP entropy srcIPEntropy as an example, the calculation formula is as follows:
[0043]
[0044] Where X is the set of source IPs in the window, n is the window size, and P(x i ) is the source IP x i Probability of occurrence.
[0045] Step 4: Calculate the mean and variance of the attack traffic and the four characteristic entropies of the attack traffic, taking the mean μ of the source IP entropy srcIPEntropy as srcIP With variance For example, the calculation formula is as follows
[0046]
[0047] Where X is the set of source IP entropy of all windows and n is the number of windows.
[0048] Step 5: Calculate the source IP entropy threshold srcIPThreshold, destination IP entropy threshold destIPThreshold, protocol entropy threshold protocolThreshold, and packet length entropy threshold pktLengthThreshold corresponding to the current data set. The setting of the threshold follows the hypothesis testing method in statistics, and the detection threshold is determined based on the confidence interval. Taking the calculation method of srcIPThreshold as an example, its confidence interval [a srcIP ,b srcIP The calculation formula of ] is as follows
[0049]
[0050] Where N is the total number of windows, μ srcIP is the mean value obtained in step 4, is the variance obtained in step 4, α represents the confidence level, Represents the Z test value. In the present invention, α=0.05 is taken. According to the standard normal distribution table, when α=0.05, The source IP entropy threshold srcIPThreshold is taken from the upper bound b of the confidence interval srcIP , the destination IP entropy threshold destIPThreshold is taken from the upper bound b of the confidence interval destIP, the protocol entropy threshold protocolThreshold is taken from the lower bound of the confidence interval a pertocol , the packet length entropy threshold pktLengthThreshold is taken from the lower bound of the confidence interval a pktLength .
[0051] Step 6: For the window set divided into units of n in step 2, extract the eleven-tuple tuple B from each window to form a new window set, and randomly divide the new window set into a training set and a test set in a ratio of 8:2.
[0052] Step 7: Train the convolutional neural network model. The CNN model consists of two convolutional layers, two pooling layers, and two fully connected layers. The convolutional layer is the core of the model and is responsible for extracting high-dimensional features of the data volume. The pooling layer reduces the number of training parameters and reduces the consumption of computing resources. The fully connected layer is used to synthesize the previously extracted features and implement classification based on these features.
[0053] Step 8: In the application, a window (array) that can accommodate n flow information is allocated to each switch. In order to include the contents of tupleA and tupleB, the spatial matrix size is n×14. Then a window is bound to each switch ID.
[0054] Step 9: Continuously monitor the status of each window. Every time the controller receives a new unmatched packet, it adds it to the window corresponding to the switch ID. When the window is filled, the rate at which the window is filled is detected.
[0055] Step 10: If the rate at which the window is filled is normal, clear the window and jump to step 9; if the rate is abnormal, mark the switch corresponding to the window as a suspicious device (a device that may be attacked) and jump to step 11.
[0056] Step 11: Calculate the real-time source IP entropy currentSrcIPEntropy, real-time destination IP entropy currentDestIPEntropy, real-time protocol entropy currentProtocolEntropy, and real-time packet length entropy currentPktLengthEntropy corresponding to the four-tuple tupleA in the window. Taking currentSrcIPEntropy as an example, the calculation formula is:
[0057]
[0058] Where X is the set of source IPs in the window, n is the window size, and P(x i ) is the source IP x i Probability of occurrence.
[0059] Step 12: Compare the real-time feature entropy calculated in step 11 with the threshold calculated in step 5. If the real-time feature entropy does not exceed the threshold, it means that the device is working normally, clear the window and continue to monitor the window; if the real-time feature entropy exceeds the threshold, it means that the device is very likely to be attacked, and the second level detection is needed to confirm whether the device is attacked, jump to step 13.
[0060] step13: Extract the content corresponding to the eleven-tuple tupleB in the window to generate a flow-feature matrix of size n×11, which is sent to the flow detection server as the input of the model.
[0061] Step 14: The flow detection server sends the model prediction results to the server where the ONOS controller is located. The CNN model can detect n traffic data at one time. If all n flows are considered normal by the model, it means that the current device is normal, clear the window and continue to monitor the window; if there is a malicious flow among the n flows, it can be finally determined that the switch is attacked and jump to step 15.
[0062] Step 15: Determine that the current network is under attack and send an alarm to the controller.
[0063] In summary, the two-level DDoS attack detection technology based on software-defined networks has refined the advantages of traditional entropy detection and machine learning detection technologies to make up for the various shortcomings of the other party in the complex network environment of SDN. Compared with other attack detection technologies, the present invention saves more system resources during continuous detection and has a faster detection speed, truly achieving high resource utilization, high detection efficiency and high accuracy at the same time.
[0064] A simple comparison of the CPU usage of the present invention and other detection technologies over time is shown in Figure 2. Figure 3 As shown, in the three time periods of 0 seconds to 11 seconds, 25 seconds to 38 seconds, and 41 seconds to 45 seconds, the CPU usage rate of the present invention is obviously the lowest among the four detection methods, and is basically the same as or even lower than other technologies in other time periods. Figure 3 , Figure 4 In the present invention, a two-level detection method is used, Ying Liu uses a technology that performs entropy detection and machine learning detection simultaneously, TiagoLinhares uses an entropy detection technology, and Vanlalruata Hnamte uses a machine learning detection technology.
[0065] Then compare the total detection time of the present invention with other detection technologies, such as Figure 4As shown, the total detection time of the present invention is much shorter than that of other traditional machine learning detection methods, and only takes a very small amount of time more than traditional entropy detection.
[0066] Finally, the accuracy of the present invention is compared with other detection technologies. As shown in Table 1, the accuracy of the present invention is almost the same as the extremely high accuracy of traditional machine learning detection technology, and is significantly higher than the accuracy of traditional entropy detection technology, truly achieving the feat of almost no impact on detection accuracy while improving detection performance.
[0067] Table 1
[0068] method Accuracy The present invention 0.9967 Ying Liu 0.9947 Tiago Linhares 0.9776 Vanlalruata Hnamte 0.9998
[0069] Judging from the results of various comparisons, the present invention has achieved good results in both detection efficiency and detection effect while occupying the least CPU resources. In the current complex and resource-limited network environment, it has strong adaptability and a wide range of application scenarios.
Claims
1. A two-stage DDoS attack detection method based on software defined network, characterized in that: The following steps are included: S1. Load the network traffic data set, divide the data in the data set into windows, calculate the four feature entropies in each window, and calculate the mean and variance of the feature entropy; S2. According to the mean and variance of feature entropy, four feature entropy thresholds are obtained through hypothesis testing; S3, dividing the set of windows into a training set and a test set, training and testing the CNN model; S4, allocate a window of size n to each switch, monitor each window, and detect the rate at which the window is filled. If normal, continue to monitor the window; if abnormal, jump to S5; S5, calculating four characteristic entropies in the abnormal window, and comparing the four characteristic entropies with the threshold of the characteristic entropy, if the threshold is not exceeded, continuing the window monitoring; If it exceeds the threshold, jump to S6; S6, input the abnormal window into the trained CNN model, if the CNN model determines it is a normal flow, continue to monitor the window; If it is an attack flow, an alarm is triggered.
2. The two-stage DDoS attack detection method based on software defined network according to claim 1 is characterized in that: The window division of the data in the data set is specifically: the data in the network traffic data set is divided into two different window sizes, one is to divide the window in units of n; the other is to calculate according to the approximate distribution of the record packet length, and divide the window according to the calculated packet length.
3. The two-stage DDoS attack detection method based on software defined network according to claim 2 is characterized in that: The calculation of the four feature entropies in each window is specifically as follows: Shannon entropy is calculated for two windows. The source IP entropy srcIPEntropy, destination IP entropy destIPEntropy, and protocol entropy protocolEntropy are calculated for the window with n as the unit; the packet length entropy pktLengthEntropy is calculated for the window divided by packet length.
4. The two-stage DDoS attack detection method based on software defined network according to claim 3 is characterized in that: The specific process of obtaining the threshold values of the four characteristic entropies through hypothesis testing is as follows: respectively calculating the mean μ and variance σ of the four characteristic entropies 2 , calculate the confidence interval of each feature, and determine the source IP entropy threshold srcIPThreshold, the destination IP entropy threshold destIPThreshold, the protocol entropy threshold protocolThreshold, and the packet length entropy threshold pktLengthThreshold based on the confidence interval.
5. The two-stage DDoS attack detection method based on software defined network according to claim 4 is characterized in that: The specific process of determining the source IP entropy threshold srcIPThreshold, the destination IP entropy threshold destIPThreshold, the protocol entropy threshold protocolThreshold and the packet length entropy threshold pktLengthThreshold by the confidence interval is as follows: Confidence interval [a srcIP ,b srcIP The calculation formula of ] is as follows Where N is the total number of windows, μ srcIP is the obtained mean, is the obtained variance, α represents the confidence level, Represents the z test value; the source IP entropy threshold srcIPThreshold is taken from the upper bound b of the confidence interval srcIP , the destination IP entropy threshold destIPThreshold is taken from the upper bound b of the confidence interval destIP , the protocol entropy threshold protocolThreshold is taken from the lower bound of the confidence interval a protocol , the packet length entropy threshold pktLengthThreshold is taken from the lower bound of the confidence interval a pktLength .
6. The two-stage DDoS attack detection method based on software defined network according to claim 5 is characterized in that: The specific process of monitoring each window and detecting the rate at which the window is filled is as follows: The content of monitoring is the rate at which the window is filled with data packets received by the controller. If the rate at which the window is filled does not exceed the threshold filledRateThreshold, the window is cleared and the window continues to be monitored; if the rate at which the window is filled exceeds the threshold filledRateThreshold, the source IP, destination IP, packet length, and protocol in the window of the switch are recorded, and jump to S5.
7. The two-stage DDoS attack detection method based on software defined network according to claim 6 is characterized in that: The specific implementation process of step S5 is as follows: The real-time source IP entropy currentsteprcIPEntropy, the real-time destination IP entropy currentDestIPEntropy, the real-time protocol entropy currentProtocolEntropy and the real-time packet length entropy currentPktLengthEntropy are calculated using the information monitored and recorded for each window, and compared with the source IP entropy threshold srcIPThreshold, the destination IP entropy threshold destIPThreshold, the protocol entropy threshold protocolThreshold and the packet length entropy threshold pktLengthThreshold respectively. If the threshold is not exceeded, the window is cleared and the window is continued to be monitored; if the threshold is exceeded, jump to S6.